Articles for a Laravel site without manual work
Add a route in routes/api.php and a controller that verifies the signature and saves the article with updateOrCreate keyed by our service id. That way a repeated delivery updates the record instead of creating a second one.
Publishing to any website is included from the Starter plan.
How it works
Add the controller and route
app/Http/Controllers/SeoWriterController.php and one line in routes/api.php. Routes in the api group need no csrf token, which is exactly what we want.
Set the key
SEOWRITER_SECRET in .env, then php artisan config:clear if you cache the config.
Wire it to your model
Add a seowriter_id column with a unique index to your posts table — the record is looked up by it.
Handler for Laravel
The body comes from $request->getContent() — the raw request bytes. The signed string is “timestamp.body”, algorithm HMAC-SHA256. The timestamp inside the signature prevents replay of a captured request: reject anything older than five minutes. The header may carry several signatures separated by commas — that is the 24 hours after a key rotation, and every one of them must be checked.
// routes/api.php
Route::post('/seowriter', [SeoWriterController::class, 'handle']);
// app/Http/Controllers/SeoWriterController.php
public function handle(Request $request): JsonResponse
{
$raw = $request->getContent();
$timestamp = $request->header('X-SEOWriter-Timestamp', '');
$header = $request->header('X-SEOWriter-Signature', '');
$event = $request->header('X-SEOWriter-Event', '');
if (abs(time() - (int) $timestamp) > 300) {
return response()->json(['ok' => false, 'error' => 'stale'], 401);
}
$expected = hash_hmac('sha256', $timestamp . '.' . $raw, env('SEOWRITER_SECRET'));
$valid = false;
foreach (explode(',', $header) as $part) {
$part = trim($part);
if (str_starts_with($part, 'v1=') && hash_equals($expected, substr($part, 3))) {
$valid = true;
}
}
if (!$valid) {
return response()->json(['ok' => false], 401);
}
if ($event === 'ping') {
return response()->json(['success' => true, 'cms' => 'Laravel ' . app()->version()]);
}
$article = json_decode($raw, true)['article'];
// Ключ — seowriter_id: повторная доставка обновит запись, а не создаст вторую
$post = Post::updateOrCreate(
['seowriter_id' => $article['id']],
[
'title' => $article['h1'],
'slug' => $article['slug'],
'body' => $article['content_html'],
'excerpt' => $article['excerpt'],
'meta_title' => $article['meta']['title'],
'meta_desc' => $article['meta']['description'],
'cover_url' => $article['cover']['url'] ?? null,
'published' => $article['status'] === 'publish',
]
);
// Верните url — от него зависят внутренняя перелинковка и анонсы в соцсетях
return response()->json(['ok' => true, 'id' => $post->id, 'url' => route('posts.show', $post->slug)]);
}What arrives with every article
Not just HTML: everything a page needs comes as separate fields, so there is no need to parse the text with regular expressions.
| article.id | Permanent article id. Update your record by it so a repeated delivery does not create a duplicate |
| article.status | draft or publish — publish right away or keep as a draft |
| article.title, h1, slug | Title, H1 and slug |
| article.content_html | Ready article HTML with structured data inside |
| article.meta | Meta title and description for the title tag and meta description |
| article.cover | Cover: URL, alt and whether the link is permanent |
| article.images | Images from the text. Each says whether it is hosted by us or by a third party |
| article.faq | Question and answer pairs — if you render your own FAQ block instead of parsing HTML |
| article.json_ld | Schema.org markup blocks as separate objects |
| article.category | Category if one is set in site settings |
Who webhook delivery is for
Developers of custom projects
The site is hand-written or built on a framework, and a ready integration for it does not exist and never will. The handler takes thirty lines and lives in your repository along with the rest of the code.
Agencies with a mixed client base
One client runs WordPress, another a custom admin panel, a third Next.js. The webhook removes the question “do you support this CMS”: any of them works, and all client sites live in one account.
Headless projects and static sites
Content lives in your own database or a headless CMS while pages are built at deploy time. The handler saves the article and triggers a rebuild, so the publication appears without a manual commit.
By hand versus by webhook
An article can always be moved by hand — the question is what that costs over time.
| By hand | By webhook | |
|---|---|---|
| Getting an article onto the site | Copying text, images and meta tags by hand | Arrives ready within seconds after generation |
| Time per article | 20–30 minutes of transferring and formatting | Zero: no human involved |
| Images and cover | Download, upload, set alt text | Arrive as links, the cover as a separate field |
| Structured data and FAQ | Assemble manually or forget about it | Ready Schema.org blocks as separate fields |
| Scheduled publishing | Someone has to be there at the right hour | Runs on its own, even at night |
| If the site was down | The article waits until someone remembers it | Six retries over eight hours plus a delivery log |
Security
- Every request is signed with a key known only to you and us.
- The signature timestamp prevents replaying a captured request: anything older than five minutes is rejected.
- We send over https only and never follow redirects.
- The key can be rotated: for 24 hours requests carry both the old and the new signature so your handler can catch up.
Hand the setup to your AI
Paste this prompt into Claude Code, Cursor or Codex inside your own project: it describes the contract without secrets, and the assistant wires the handler in following your codebase conventions.
My project needs a server-side webhook handler for the SEO Writer service.
Add a POST endpoint at /api/seowriter using the project's current stack, routing and ORM.
Do not create a separate microservice if the project already has a backend.
The request arrives with these headers:
X-SEOWriter-Event: article.published | article.updated | ping
X-SEOWriter-Timestamp: unix time in seconds
X-SEOWriter-Signature: v1=<hex>[,v1=<hex>]
X-SEOWriter-Delivery: delivery id, identical across retries
The body is JSON:
{ "event": "article.published",
"article": { "id": "uuid", "status": "draft|publish", "title": "...", "h1": "...", "slug": "...",
"content_html": "...", "excerpt": "...", "meta": {"title": "...", "description": "..."},
"cover": {"url": "...", "alt": "..."}, "images": [{"url": "...", "alt": "..."}],
"faq": [{"question": "...", "answer": "..."}], "json_ld": [...] } }
Implement step by step:
1. Read the body as raw bytes or text BEFORE parsing JSON.
2. Compute HMAC-SHA256 over "{timestamp}.{raw body}" with the key from the SEOWRITER_SECRET environment variable.
3. The signature header may hold several v1= values separated by commas — check EVERY one, any match counts. Use a constant-time comparison, not plain equality.
4. Reject with 401 if the signature does not match or the timestamp differs from now by more than 300 seconds.
5. Answer ping with 200 and JSON {"success": true}.
6. On article.published and article.updated save the article into the project's existing publication model, updating the record by article.id — a repeated delivery must not create a duplicate. Use content_html as the ready page body.
7. Answer with 200 and JSON {"ok": true, "url": "<published article URL>"} — the service needs that URL for internal linking.
8. Answer fast: move heavy processing into a background job.
Constraints:
- never hardcode the secret, read it from the environment;
- never disable signature verification, not even temporarily;
- never answer with a redirect;
- accept POST only.
At the end, tell me the full endpoint URL after deployment and where to add SEOWRITER_SECRET.FAQ
The route is in the web group — what changes?
Exclude it from csrf verification: add the path to $except in VerifyCsrfToken. The request comes from outside and cannot carry a token.
Processing takes a while — what should I do?
Reply immediately and push the work to a queue: dispatch(new ProcessArticle($article)). We wait thirty seconds for a response, and this is the case where replying fast and finishing in the background is better.
How do I tell a new article from an update?
By the X-SEOWriter-Event header: article.published comes on first publication, article.updated on changes — for instance when we deliver the cover afterwards. Handle both or the cover never arrives.
The article does not go through, the server answers 413
That is the request body size limit. A long article with all its data weighs a few hundred kilobytes while nginx defaults to one megabyte. Raise client_max_body_size to 5m.
What users say
Real results from real people
“I used to pay 3–4 copywriters $15 per article and spend 2 days on approvals. Now I upload 20 keywords on Sunday — by Monday all articles are in WordPress. Organic traffic grew 40% in three months.”
“We manage 12 client sites. Content used to be the bottleneck — not anymore. SEO Writer generates texts with proper H1/H2/H3 structure, fills Yoast and internal links. Clients are happy, we can take on new ones.”
“We needed review articles for each product category. With SEO Writer we covered 60 queries in one month — with images, links to product pages and meta descriptions. That volume with copywriters would have cost $900.”
Pricing
Start free, scale as you grow
Starter
1 290 ₽ · billed in RUB
- 15 articles/month
- 2 sites
- System API keys
- Topic research: 4 runs/month
- Custom API keys
- Scheduler
- Article rewrite for external platforms
Pro
2 990 ₽ · billed in RUB
- 50 articles/month
- 5 sites
- System API keys
- Topic research: 10 runs/month
- Custom API keys
- Scheduler
- Article rewrite for external platforms
- Cover generation
Agency
9 990 ₽ · billed in RUB
- 150 articles/month
- 20 sites
- System API keys
- Topic research: 30 runs/month
- Custom API keys
- Scheduler
- Article rewrite for external platforms
- Cover generation
- API access (coming soon)
- Priority support
Secure payment via YooKassa · No auto-renewal · 30 days access
See also
What if you run a popular CMS
For these platforms no handler is needed — connecting takes a couple of minutes with a login and a password.
Your site starts filling itself
Setup takes half an hour including the handler. After that articles arrive on schedule and every delivery is visible in your account.
Create a free account →Useful articles
September 15, 2026
Токены нейросети: что это и как считать расход
Токены нейросети: чем токен отличается от слова, почему русский текст дороже английского и как считать расход генерации.
ReadSeptember 14, 2026
Перелинковка сайта: схемы, анкоры и типичные ошибки
Как устроена перелинковка страниц сайта: зачем она нужна, какие бывают схемы, сколько ссылок ставить в статью, как подобрать анкоры и каких ошибок избежать.
ReadSeptember 13, 2026
Поведенческие факторы: что это и как их улучшить
Что относится к поведенческим факторам, как Яндекс их считает, что реально можно улучшить текстом и чем заканчивается накрутка.
Read